Overview 440 matches · 0 in Waratek scope · 0 protected · 13 exploited · 8 CISA KEV · 23 public PoC · 15 EPSS ≥ 0.5
440matches
0in Waratek scope0.0%
0protected0.0%
13exploited3.0%
8CISA KEV1.8%
23public PoC5.2%
15EPSS ≥ 0.53.4%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
11
2.5%
Not applicable
429
97.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
440
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 70 / year
20021
Not applicable1
Medium1
not blocked1
Working exploit published1
20030
20040
20057
Not applicable7
High2
Medium5
not blocked7
Working exploit published2
No public exploit5
200637
Not applicable37
High12
Medium20
Low5
not blocked37
Working exploit published1
No public exploit36
200735
Not applicable35
High7
Medium23
Low5
not blocked35
Working exploit published1
No public exploit34
200870
Not applicable70
High13
Medium47
Low10
not blocked70
No public exploit70
200953
Not applicable53
High8
Medium29
Low16
not blocked53
Working exploit published1
No public exploit52
20108
Not applicable8
Medium5
Low3
not blocked8
No public exploit8
20113
Not applicable3
High1
Medium1
Low1
not blocked3
No public exploit3
201213
Not applicable13
High1
Medium11
Low1
not blocked13
Working exploit published1
No public exploit12
201314
Not applicable14
Medium11
Low3
not blocked14
No public exploit14
201436
Outside Waratek scope1
Not applicable35
High2
Medium17
Low17
not blocked36
Exploited1
Working exploit published1
No public exploit34
201510
Not applicable10
High1
Medium8
Low1
not blocked10
No public exploit10
201620
Outside Waratek scope1
Not applicable19
High10
Medium10
not blocked20
Forecast only1
No public exploit19
20178
Not applicable8
High4
Medium4
not blocked8
No public exploit8
201814
Not applicable14
Critical4
High3
Medium7
not blocked14
Exploited3
Forecast only1
No public exploit10
201925
Outside Waratek scope1
Not applicable24
Critical5
High7
Medium13
not blocked25
Exploited3
Proof of concept only1
No public exploit21
202011
Outside Waratek scope3
Not applicable8
Critical3
High3
Medium5
not blocked11
Exploited4
Proof of concept only1
No public exploit6
202114
Outside Waratek scope3
Not applicable11
Critical1
High5
Medium8
not blocked14
Exploited1
Working exploit published1
Proof of concept only1
No public exploit11
202220
Outside Waratek scope2
Not applicable18
Critical2
High9
Medium9
not blocked20
Proof of concept only1
No public exploit19
20239
Not applicable9
High4
Medium5
not blocked9
No public exploit9
202410
Not applicable10
Critical3
High3
Medium4
not blocked10
Working exploit published1
No public exploit9
202513
Not applicable13
High3
Medium9
Low1
not blocked13
No public exploit13
20269
Not applicable9
Critical1
Medium7
Low1
not blocked9
Exploited1
No public exploit8
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2013-6387 | Low | 2013-12-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field. |
| CVE-2013-6389 | Medium | 2013-12-07 | Not applicable | No public exploit | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. |
| CVE-2013-6386 | Medium | 2013-12-07 | Not applicable | No public exploit | Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack. |
| CVE-2013-6385 | Medium | 2013-12-07 | Not applicable | No public exploit | The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors. |
| CVE-2012-0827 | Low | 2013-10-28 | Not applicable | No public exploit | The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors. |
| CVE-2012-0826 | Medium | 2013-10-28 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors. |
| CVE-2012-0825 | Medium | 2013-10-28 | Not applicable | No public exploit | Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack. |
| CVE-2013-0246 | Medium | 2013-07-16 | Not applicable | No public exploit | The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors. |
| CVE-2013-0245 | Low | 2013-07-16 | Not applicable | No public exploit | The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors. |
| CVE-2013-0316 | Medium | 2013-03-27 | Not applicable | No public exploit | The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests. |
| CVE-2012-5653 | Medium | 2013-01-03 | Not applicable | No public exploit | The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name. |
| CVE-2012-5652 | Medium | 2013-01-03 | Not applicable | No public exploit | Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result. |
| CVE-2012-5651 | Medium | 2013-01-03 | Not applicable | No public exploit | Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results. |
| CVE-2012-4554 | Medium | 2012-11-11 | Not applicable | No public exploit | The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file. |
| CVE-2012-4553 | Medium | 2012-11-11 | Not applicable | No public exploit | Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server, related to "transient conditions." |
| CVE-2012-2153 | Medium | 2012-10-01 | Not applicable | No public exploit | Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page. |
| CVE-2012-1591 | Medium | 2012-10-01 | Not applicable | No public exploit | The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles. |
| CVE-2012-1590 | Medium | 2012-10-01 | Not applicable | No public exploit | The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page. |
| CVE-2012-1588 | Low | 2012-10-01 | Not applicable | No public exploit | Algorithmic complexity vulnerability in the _filter_url function in the text filtering system (modules/filter/filter.module) in Drupal 7.x before 7.14 allows remote authenticated users with certain roles to cause a denial of service (CPU consumption) via a long email address. |
| CVE-2012-1646 | Medium | 2012-09-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module. |
| CVE-2012-2298 | Medium | 2012-08-14 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) "user names in page titles" and (2) "autocomplete callbacks." |
| CVE-2012-2306 | High | 2012-07-25 | Not applicable | No public exploit | SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-2922 | Medium | 2012-05-21 | Not applicable | No public exploit | The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message. |
| CVE-2012-2339 | Medium | 2012-05-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "taxonomy information." |
| CVE-2012-1589 | Medium | 2012-05-18 | Not applicable | No public exploit | Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL. |
| CVE-2007-6752 | Medium | 2012-03-28 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off. |
| CVE-2011-4560 | Low | 2011-11-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Petition Node module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to signing a petition. |
| CVE-2011-3730 | Medium | 2011-09-23 | Not applicable | No public exploit | Drupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/simpletest/tests/upgrade/drupal-6.upload.database.php and certain other files. |
| CVE-2011-2687 | High | 2011-07-27 | Not applicable | No public exploit | Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table. |
| CVE-2010-3686 | Medium | 2010-09-29 | Not applicable | No public exploit | The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
| CVE-2010-3685 | Medium | 2010-09-29 | Not applicable | No public exploit | The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
| CVE-2010-3091 | Medium | 2010-09-29 | Not applicable | No public exploit | The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
| CVE-2010-3094 | Low | 2010-09-21 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the actions feature and the trigger module. |
| CVE-2010-3093 | Low | 2010-09-21 | Not applicable | No public exploit | The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue. |
| CVE-2010-3092 | Medium | 2010-09-21 | Not applicable | No public exploit | The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name. |
| CVE-2010-3022 | Low | 2010-08-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Performance logging module in the Devel module 5.x before 5.x-1.3 and 6.x before 6.x-1.21 for Drupal allows remote authenticated users, with add url aliases and report access permissions, to inject arbitrary web script or HTML via crafted node paths in a URL. |
| CVE-2009-4602 | Medium | 2010-01-12 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Randomizer module 5.x through 5.x-1.0 and 6.x through 6.x-1.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2009-4371 | Low | 2009-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the (1) Language name in English or (2) Native language name fields in the Custom language form. |
| CVE-2009-4370 | Low | 2009-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly handled in the menu administration overview. |
| CVE-2009-4369 | Low | 2009-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script or HTML via the contact category name. |
| CVE-2009-4066 | Medium | 2009-11-24 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or (2) unsubscribing to mailing lists. |
| CVE-2009-3479 | Medium | 2009-09-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x before 5.x-1.17 and 6.x before 6.x-1.6, a module for Drupal, allows remote attackers, with "create content displayed by the Bibliography module" permissions, to inject arbitrary web script or HTML via a title. |
| CVE-2009-3352 | High | 2009-09-24 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the quota_by_role (Quota by role) module for Drupal have unknown impact and attack vectors. |
| CVE-2009-3156 | Low | 2009-09-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field. |
| CVE-2009-2374 | Medium | 2009-07-08 | Not applicable | No public exploit | Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from those links or (2) when page caching is enabled, the Drupal page cache. |
| CVE-2009-2373 | Medium | 2009-07-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2009-2372 | Medium | 2009-07-08 | Not applicable | No public exploit | Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature. |
| CVE-2009-2079 | Low | 2009-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via (1) vocabulary names, (2) synonyms, and (3) term names. |
| CVE-2009-2076 | Low | 2009-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions. |
| CVE-2009-2074 | Low | 2009-06-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via vocabulary names. |
| CVE-2009-2035 | Medium | 2009-06-12 | Not applicable | No public exploit | Unspecified vulnerability in Services 6.x before 6.x-0.14, a module for Drupal, when key-based access is enabled, allows remote attackers to read or add keys and access unauthorized services via unspecified vectors. |
| CVE-2009-1942 | Low | 2009-06-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Quiz module 5.x, 6.x-2.x before 6.x-2.2, and 6.x-3.x before 6.x-3.0, a module for Drupal, allows remote authenticated users, with create quizzes or quiz questions access, to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2009-1844 | Low | 2009-06-01 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the "HTML exports of books" feature; and (2) allow remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via the help text of an arbitrary vocabulary. NOTE: vector 1 exists because of an incomplete fix for CVE-2009-1575. |
| CVE-2009-1823 | Low | 2009-05-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.7 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML by modifying a document head, before the Content-Type META element, to contain crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, a related issue to CVE-2009-1575. |
| CVE-2009-1576 | Medium | 2009-05-06 | Not applicable | No public exploit | Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site, possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc, as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks. |
| CVE-2009-1575 | Medium | 2009-05-06 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7. |
| CVE-2009-1507 | High | 2009-05-01 | Not applicable | No public exploit | The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node. |
| CVE-2009-1505 | Medium | 2009-05-01 | Not applicable | No public exploit | SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field. |
| CVE-2009-1344 | Medium | 2009-04-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Localization client module 5.x before 5.x-1.2 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via input to the translation functionality. |
| CVE-2009-1343 | Medium | 2009-04-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.5 and 6.x before 6.x-1.5, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via content titles. |
| CVE-2009-1342 | Medium | 2009-04-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the CCK comment reference module 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via certain comment titles associated with a node edit form. |
| CVE-2009-1249 | Medium | 2009-04-06 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the content title in admin/content/node-type/nodetype/map. |
| CVE-2009-1069 | Medium | 2009-03-26 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) titles of candidate referenced nodes in the Node reference sub-module and the (2) names of candidate referenced users in the User reference sub-module. |
| CVE-2008-6533 | Medium | 2009-03-26 | Not applicable | No public exploit | Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. |
| CVE-2008-6532 | Medium | 2009-03-26 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database. |
| CVE-2009-1047 | Medium | 2009-03-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail. |
| CVE-2009-1037 | Medium | 2009-03-20 | Not applicable | No public exploit | Unspecified vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to send unlimited spam messages via unknown vectors related to the flood control API. |
| CVE-2009-1036 | Medium | 2009-03-20 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Plus 1 module before 6.x-2.6, a module for Drupal, allows remote attackers to cast votes for content via unspecified aspects of the URI. |
| CVE-2009-1034 | High | 2009-03-20 | Not applicable | No public exploit | SQL injection vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via values in the URI. |
| CVE-2009-0818 | Low | 2009-03-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the Vocabulary name (name parameter) to index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2009-0817 | Low | 2009-03-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module. |
| CVE-2008-6384 | Medium | 2009-03-02 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Comment Mail 5.x before 5.x-1.1, a module for Drupal, allow remote attackers to hijack the authentication of administrators. |
| CVE-2008-6383 | Medium | 2009-03-02 | Not applicable | No public exploit | SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2008-6276 | Medium | 2009-02-25 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to execute arbitrary SQL commands via (1) a content type or (2) a voting API value. |
| CVE-2008-6275 | Medium | 2009-02-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified messages. |
| CVE-2008-6229 | Low | 2009-02-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via (1) field labels and (2) content-type names. |
| CVE-2008-6171 | High | 2009-02-19 | Not applicable | No public exploit | includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header. |
| CVE-2008-6170 | Low | 2009-02-19 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title. |
| CVE-2008-6169 | Medium | 2009-02-19 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Localization client 5.x before 5.x-1.1 and 6.x before 6.x-1.6 and the Localization server 5.x before 5.x-1.0-alpha5 and 6.x before 6.x-alpha2, modules for Drupal, allows remote attackers to perform unauthorized actions as administrators via unspecified vectors related to the "local translation submission interface." |
| CVE-2008-6160 | Medium | 2009-02-18 | Not applicable | No public exploit | Semantically-Interconnected Online Communities (SIOC) 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, does not properly implement menu and database APIs, which allows remote attackers to obtain usernames and read hashed emails and comments via unspecified vectors. |
| CVE-2009-0603 | Low | 2009-02-16 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via the description parameter (aka the Help field). NOTE: some of these details are obtained from third party information. |
| CVE-2008-6137 | High | 2009-02-14 | Not applicable | No public exploit | EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to bypass access restrictions via unknown vectors. |
| CVE-2008-6136 | High | 2009-02-14 | Not applicable | No public exploit | Unspecified vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to gain privileges as another user or an administrator via unknown attack vectors. |
| CVE-2008-6135 | Medium | 2009-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2008-6134 | High | 2009-02-14 | Not applicable | No public exploit | SQL injection vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2009-0575 | Medium | 2009-02-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the theme_views_bulk_operations_confirmation function in views_bulk_operations.module in Views Bulk Operations 5.x before 5.x-1.3 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles. NOTE: some of these details are obtained from third party information. |
| CVE-2009-0382 | Medium | 2009-02-02 | Not applicable | No public exploit | Unspecified vulnerability in Internationalization (i18n) Translation 5.x before 5.x-2.5, a module for Drupal, allows remote attackers with "translate node" permissions to bypass intended access restrictions and read unpublished nodes via unspecified vectors. |
| CVE-2008-6020 | High | 2009-02-02 | Not applicable | No public exploit | SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an exposed filter on CCK text fields." |
| CVE-2008-5999 | Low | 2009-01-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows remote authenticated users, with create and edit permissions for posts, to inject arbitrary web script or HTML via unspecified vectors involving the ajax_checklist filter. |
| CVE-2008-5998 | Medium | 2009-01-28 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in the ajax_checklist_save function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a save operation, related to the (1) nid, (2) qid, and (3) state parameters. |
| CVE-2008-4793 | High | 2008-10-29 | Not applicable | No public exploit | The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules. |
| CVE-2008-4792 | Medium | 2008-10-29 | Not applicable | No public exploit | The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values. |
| CVE-2008-4791 | Medium | 2008-10-29 | Not applicable | No public exploit | The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vectors. |
| CVE-2008-4790 | Medium | 2008-10-29 | Not applicable | No public exploit | The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors. |
| CVE-2008-4789 | Medium | 2008-10-29 | Not applicable | No public exploit | The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error." |
| CVE-2008-4710 | Medium | 2008-10-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the stock quotes page in Stock 6.x before 6.x-1.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2008-4633 | Medium | 2008-10-21 | Not applicable | No public exploit | SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again" is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to a "previously cast vote." |
| CVE-2008-4598 | High | 2008-10-17 | Not applicable | No public exploit | Unspecified vulnerability in Shindig-Integrator 5.x, a module for Drupal, has unspecified impact and remote attack vectors related to "numerous flaws" that are not related to XSS or access control, a different vulnerability than CVE-2008-4596 and CVE-2008-4597. |
| CVE-2008-4597 | High | 2008-10-17 | Not applicable | No public exploit | Shindig-Integrator 5.x, a module for Drupal, does not properly restrict generated page access, which allows remote attackers to gain privileges via unspecified vectors. |
| CVE-2008-4596 | Medium | 2008-10-17 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Shindig-Integrator 5.x, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in generated pages. |